Executive brief
Unbound is a widely used DNS resolver that helps translate human-readable website names into IP addresses. A security flaw allows an attacker to trick the system into accepting fake DNS records by spoofing the identity of a primary data source. This could allow an attacker to redirect network traffic or block access to legitimate websites by replacing the resolver's entire response policy.
Technical details
A vulnerability exists in Unbound's handling of authoritative (auth) and Response Policy Zones (RPZ) when a primary hostname resolves to a BOGUS DNSSEC state. Unbound incorrectly treats these BOGUS A/AAAA records as valid XFR endpoints. An attacker capable of spoofing these records (without needing a valid RRSIG) can position themselves as the primary XFR server. This allows the attacker to push a malicious zone transfer, effectively replacing the entire zone or response policy. The issue is fixed in version 1.25.2 by ensuring BOGUS hostnames are disregarded for XFR endpoints.
Affected products
- NLnet Labs Unbound 1.7.0 to 1.25.1
Timeline
- 2026-07-22: advisory: NLnet Labs released advisory and patch for CVE-2026-50248
- 2026-07-22: patched: Fixed in Unbound version 1.25.2